Why the default app is launcher for a new user?

[ddrillic]

A user by the name Greg belongs to an ldap group which is mapped successfully to a role and this role is mapped to a new app in user-prefs.conf. However, the user shows having launcher as his default app. How can I debug it?

[woodcock]

Users may override the default app and this private settings store in his $SPLUNK_HOME/etc/apps/user/<someUserName>/ directory is hard to find. He may not have realized that he changed/saved this.

[harsmarvania57]

Hi,

I'll start with btool first for user-prefs.conf with below command

$SPLUNK_HOME/bin/splunk cmd btool user-prefs list --debug

Above command will display role mapping with application.

Below command will display user specific settings if user overwrote his/her default app.

$SPLUNK_HOME/bin/splunk cmd btool user-prefs list --debug --user=<USERNAME> --app=user-prefs

and search for default_namespace parameter.